AI for Cyber Defence: Phase One
An AI investigation layer for the SOC. A DeepAgents harness that triages SIEM incidents end to end, from raw-event queries to a scored attack story, and auto-closes the false positives.
In February 2025 I started bringing AI onto the defensive side of the MDR platform I work on at Armor. The result is an AI investigation layer that sits on top of the SIEM and does the first pass a SOC analyst would, at machine speed: it reads an incident, pulls the raw events behind it, chases the leads, and comes back with a scored attack story and a recommendation. The analysts then spend their time on the incidents that actually deserve it.
What it does
Every alert the SIEM raises kicks off an autonomous investigation. Rather than trusting the alert's summary, the agent goes to the source and works the case:
- Queries the raw events behind the incident directly, instead of reasoning from a pre-baked summary.
- Runs deeper lateral investigations, pivoting across users, hosts, and processes to see how far something reached.
- Searches history for similar incidents, so a new alert inherits the context of everything like it that came before.
- Stitches the findings into a single attack story instead of a scatter of disconnected signals.
- Summarizes entity enrichment from our threat-intelligence platforms into a few lines an analyst can act on.
- Attaches a risk score and classifications, recommends remediation, and auto-closes the benign and false-positive incidents so the queue stays focused on the real ones.
How it's wired
Under the hood it's a DeepAgents harness. A planning agent decomposes the investigation and delegates to a set of specialized tools: a natural-language query interface over the SIEM, a lateral-investigation tool, a historical-similarity search across past incidents, and threat-intelligence enrichment. The model reasons over what comes back and decides the next move, the same loop a human analyst runs, just faster and without fatigue.
Plain English to SIEM query
One piece I'm especially happy with is the query interface. SIEM query languages are powerful and unforgiving, and every platform speaks its own: KustoQL for Sentinel, plus Splunk, Elastic, and QRadar dialects. The system lets an analyst, or the agent itself, ask a question in plain English and get back a correct query for the right platform, run it, and read the results. It closes the gap between knowing what you want to ask and remembering the exact syntax to ask it, which is where a surprising amount of SOC time quietly goes.
Scoring the risk, with ARiES as a baseline
The risk score didn't come from nowhere. Anthropic published an LLM ATT&CK matrix that maps AI-enabled attacker behavior onto MITRE ATT&CK, together with a scoring approach they call ARiES, the AI Risk Enablement Score. Instead of the classic multiplicative Threat × Vulnerability × Impact, ARiES adds three bounded components so the signal survives even when one dimension is thin: the actor's threat profile, the degree of AI assistance involved, and the real-world impact. That gave me a defensible baseline to adapt for scoring our own incidents.
Their findings shaped what we weight, too. In Anthropic's dataset, lateral movement was the single strongest predictor of a high-risk actor, and the most dangerous actors weren't the most technically skilled but the most orchestrated, the ones who wired agentic tooling into an autonomous attack platform. So our triage leans hard on lateral movement and agentic patterns rather than raw technique count.
MITRE ATT&CK wasn't built for this
There's a deeper problem under the scoring. MITRE ATT&CK, the framework everyone reaches for, was built to describe human attackers and traditional intrusions. Anthropic's ATT&CK Navigator research makes the case plainly: it doesn't yet capture the AI-native behavior that makes these actors dangerous, the autonomous orchestration, real-time pivoting, and technique chaining that a human operator couldn't sustain. The framework has to adapt.
Community efforts are already filling the gap. InjectLab, an open project by Austin Howard, is one worth knowing: an ATT&CK-style matrix built specifically for LLM attacks, with tactics like prompt injection, role override, execution hijack, information disclosure, output manipulation, and multi-agent exploitation, each broken into concrete techniques. For a defender, a shared vocabulary like this is what makes it possible to tag, score, and reason about AI-enabled attacks consistently, the way ATT&CK did for the last generation of threats.
An attack taxonomy built for LLMs, where MITRE ATT&CK stops short. Click a technique.
Malicious input that overrides the model's intended instructions.
Where the inspiration came from
The whole direction was set by Anthropic's research on building AI for cyber defenders. Coming across it in October crystallized something I'd been circling: the same capabilities that help attackers can be pointed the other way, and defenders shouldn't cede that ground. Their argument, backed by models that now find and triage real vulnerabilities, is what pushed me to lean into defensive AI as aggressively as I did for our customers.
Project Glasswing has been inspiring in the same spirit: that Anthropic could convene the world's leading technology companies to secure critical software, and the concrete work behind it, using property-based testing to hunt bugs across the Python ecosystem and reporting real vulnerabilities to projects like Firefox, OpenBSD, and FFmpeg. It's AI turned toward security at scale.